Quick answer: Healthcare SEO itself is not restricted by HIPAA, but the tracking around it can be. If analytics tags, ad pixels or chat tools on a covered provider’s website send protected health information, such as data from appointment forms or patient portals, to a vendor without a business associate agreement, that can be a HIPAA violation. A 2024 court ruling narrowed federal guidance for public pages, but pages behind logins and booking flows still need careful handling.
I work with medical, dental, therapy and wellness practices, and the same question comes up in every one: “Can we still use Google Analytics?” The honest answer is that it depends on what you track, where and with which vendors. This guide explains the rules in plain terms and how to keep measuring SEO without creating compliance risk. I am an SEO consultant, not a lawyer, so treat this as a starting point for a conversation with your compliance or legal advisor.
Why tracking is the issue, not SEO
Ranking a practice in Google involves content, local listings, reviews and technical work. None of that touches patient data. The risk appears when tracking technologies, such as analytics scripts, advertising pixels, heatmaps, chat widgets or form tools, collect information that can identify a patient and relate to their health, then share it with a third party.
The HHS guidance and the 2024 court ruling
- December 2022: the HHS Office for Civil Rights (OCR) issued a bulletin on online tracking technologies, saying that identifiers such as IP addresses combined with health-related browsing could be protected health information.
- March 2024: OCR updated the bulletin.
- June 2024: in American Hospital Association v. Becerra, a federal court in Texas ruled that part of the guidance exceeded HHS’s authority. The vacated portion concerned visits to public, unauthenticated pages where the only link to health was the topic of the page.
- August 2024: HHS withdrew its appeal.
What remains clear: tracking on authenticated pages, such as patient portals, and on pages where patients submit health information, such as appointment requests and intake forms, can involve protected health information. Covered entities need either a business associate agreement with the vendor or a setup that keeps that data out of the vendor’s hands.
State laws and the FTC
HIPAA is not the only rule. Washington’s My Health My Data Act and similar state laws cover consumer health data more broadly, including some businesses not covered by HIPAA. The FTC’s Health Breach Notification Rule applies to certain health apps and services outside HIPAA. Med spas, wellness clinics and IV therapy businesses should check which rules apply to them, not just assume HIPAA does or does not.
A practical, lower-risk tracking setup
| Area | Higher-risk setup | Lower-risk alternative |
|---|---|---|
| Appointment and contact forms | Ad pixels firing on submission with form fields captured | Track a generic “form submitted” event with no field data, or use a vendor that signs a BAA |
| Patient portal | Standard analytics and pixels on logged-in pages | No third-party tracking on authenticated pages |
| Thank-you page URLs | URLs like /thank-you/?service=depression-therapy | Neutral URLs with no condition or service in them |
| Analytics | Default client-side tags sending full URLs and IPs | Server-side tagging that strips identifiers, or analytics vendors that sign BAAs |
| Chat and call tracking | Tools that record health details without a BAA | HIPAA-eligible tools under a signed BAA |
Google’s own documentation says Google Analytics customers must not use it in ways that create obligations under HIPAA, and Google does not sign business associate agreements for Analytics. That does not mean you cannot use it at all, but it does mean configuring it so that protected health information never reaches it.
How to measure SEO without risky data
The good news for SEO is that the most important data does not involve patients at all:
- Search Console shows queries, impressions, clicks and pages from Google’s side. It contains no visitor-level data.
- Business Profile performance shows calls, direction requests and website clicks in aggregate.
- Aggregate conversion counts, such as “appointment requests this month” from your practice management system, can be compared with organic traffic trends without linking individuals.
- Rank tracking for your key services and locations needs no visitor data.
My guide to SEO KPIs covers how to build a report from these sources.
Review replies are a privacy risk too
Replying “We’re glad your root canal went well, John” confirms that John is a patient and reveals treatment details. Keep replies general: thank the reviewer, avoid confirming they are a patient and move any specific discussion offline. This applies to Google, Yelp and every other platform. My guide to getting more Google reviews covers review systems in general.
A quick audit you can run this week
- List every script and pixel on your site, including those added through a tag manager.
- Check which ones fire on forms, booking pages, thank-you pages and the patient portal.
- Check your URLs for condition or treatment names in parameters.
- Confirm which vendors have signed business associate agreements.
- Remove or reconfigure anything that sends identifiable health information to a vendor without one.
Practices I work with across dental, therapy, physical therapy and med spa settings all go through this review first. The wider approach is on my healthcare and wellness SEO page, and a tracking review can be included in an SEO audit.
Frequently asked questions
Is Google Analytics HIPAA compliant?
Google does not sign business associate agreements for Google Analytics and says it must not be used in ways that create HIPAA obligations. It can be configured to avoid collecting protected health information, but that needs careful setup.
Can healthcare websites use Meta or Google Ads pixels?
Not on pages or events where they would receive protected health information. Many practices now use server-side setups or remove pixels from booking and portal pages entirely.
Does the 2024 court ruling mean tracking is fine now?
No. It narrowed the guidance for some public pages. Authenticated pages and forms with health information are still a concern, and state laws may apply.
Does HIPAA restrict healthcare SEO content?
No. You can publish educational content, service pages and location pages freely. The restrictions concern patient information, including in testimonials, which need written authorization.
Sources: HHS: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; Google Analytics Help: HIPAA and Google Analytics; FTC: Health Breach Notification Rule basics for business.
